Pat,
Does a URL or "/j_security_check" or "/closed/*" get called? If you aren't sure, you could check the logs or have a filter with "/*" output all the URLs it sees. My guess is you are relying on j_security_check and a slightly different URL is getting called.